/
MailboxesUserCanAccess.ps1
173 lines (168 loc) · 7.64 KB
/
MailboxesUserCanAccess.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
<#
=============================================================================================
Name: List all Exchange Online mailboxes users can access
Version: 1.0
Website: m365scripts.com
Script by: M365Scripts Team
Script Highlights:
~~~~~~~~~~~~~~~~~
1.Exports mailbox rights for all users by default.
2.Allows to generate mailbox rights report for a list of users through input CSV.
3.List mailboxes the users have Send As/Send On Behalf/Full Access permissions.
4.The script can also be executed with MFA enabled account also.
5.Export report results to CSV file.
6.The script is scheduler-friendly. i.e., credentials are passed as parameters, so worry not!
For detailed script execution: https://m365scripts.com/exchange-online/URL Sluglist-exchange-online-mailboxes-user-has-access-using-powershell
============================================================================================
#>
Param
(
[Parameter(Mandatory = $false)]
[string]$UserName = $NULL,
[string]$Password = $NULL,
[string]$UPN = $NULL,
[string]$CSV = $NULL,
[switch]$FullAccess,
[switch]$SendAs,
[switch]$SendOnBehalf
)
function Connect_Exo {
#Check for EXO v2 module inatallation
$Module = Get-Module ExchangeOnlineManagement -ListAvailable
if ($Module.count -eq 0) {
Write-Host "Exchange Online PowerShell V2 module is not available" -ForegroundColor yellow
$Confirm = Read-Host "Are you sure you want to install module? [Y] Yes [N] No"
if ($Confirm -match "[yY]") {
Write-host "Installing Exchange Online PowerShell module"
Install-Module ExchangeOnlineManagement -Repository PSGallery -AllowClobber -Force
}
else {
Write-Host EXO V2 module is required to connect Exchange Online.Please install module using Install-Module ExchangeOnlineManagement cmdlet.
Exit
}
}
Write-Host Connecting to Exchange Online...
#Importing Module by default will avoid the cmdlet unrecognized error
Import-Module ExchangeOnline -ErrorAction SilentlyContinue -Force
#Storing credential in script for scheduling purpose/ Passing credential as parameter - Authentication using non-MFA account
if (($UserName -ne "") -and ($Password -ne "")) {
$SecuredPassword = ConvertTo-SecureString -AsPlainText $Password -Force
$Credential = New-Object System.Management.Automation.PSCredential $UserName, $SecuredPassword
Connect-ExchangeOnline -Credential $Credential
}
else {
Connect-ExchangeOnline
}
Write-Host "ExchangeOnline PowerShell module is connected successfully"
}
function FullAccess {
$MB_FullAccess = $global:Mailbox | Get-MailboxPermission -User $UPN -ErrorAction SilentlyContinue | Select-Object Identity
if ($MB_FullAccess.count -ne 0) {
$ExportResult = @{'User Name' = $Identity; 'AccessType' = "Full Access"; 'Delegated Mailbox Name' = $MB_FullAccess.Identity -join (",") }
}
else {
$ExportResult = @{'User Name' = $Identity; 'AccessType' = "Full Access"; 'Delegated Mailbox Name' = "-" }
}
$ExportResults = New-Object PSObject -Property $ExportResult
$ExportResults | Select-object 'User Name', 'AccessType', 'Delegated Mailbox Name' | Export-csv -path $global:ExportCSVFileName -NoType -Append -Force
}
function SendAs {
$MB_SendAs = Get-RecipientPermission -Trustee $UPN -ErrorAction SilentlyContinue | Select-Object Identity
if ($MB_SendAs.count -ne 0) {
$ExportResult = @{'User Name' = $Identity; 'AccessType' = "Send As"; 'Delegated Mailbox Name' = $MB_SendAs.Identity -join (",") }
}
else {
$ExportResult = @{'User Name' = $Identity; 'AccessType' = "Send As"; 'Delegated Mailbox Name' = "-" }
}
$ExportResults = New-Object PSObject -Property $ExportResult
$ExportResults | Select-object 'User Name', 'AccessType', 'Delegated Mailbox Name' | Export-csv -path $global:ExportCSVFileName -NoType -Append -Force
}
function SendOnBehalfTo {
$MB_SendOnBehalfTo = $global:Mailbox | Where-Object { $_.GrantSendOnBehalfTo -match $Identity } -ErrorAction SilentlyContinue | Select-Object Name
if ($MB_SendOnBehalfTo.count -ne 0) {
$ExportResult = @{'User Name' = $Identity; 'AccessType' = "Send on Behalf"; 'Delegated Mailbox Name' = $MB_SendOnBehalfTo.Name -join (",") }
}
else {
$ExportResult = @{'User Name' = $Identity; 'AccessType' = "Send on Behalf"; 'Delegated Mailbox Name' = "-" }
}
$ExportResults = New-Object PSObject -Property $ExportResult
$ExportResults | Select-object 'User Name', 'AccessType', 'Delegated Mailbox Name' | Export-csv -path $global:ExportCSVFileName -NoType -Append -Force
}
Connect_Exo
$global:ExportCSVFileName = "MailboxesUserHasAccessTo_" + ((Get-Date -format "MMM-dd hh-mm-ss tt").ToString()) + ".csv"
$global:Mailbox = Get-Mailbox -ResultSize Unlimited
if (($UPN -ne "")) {
$UserInfo = $global:Mailbox | Where-Object { $_.UserPrincipalName -eq "$UPN" } | Select-Object Identity
$Identity = $UserInfo.Identity
if ($FullAccess.IsPresent) {
FullAccess
}
if ($SendAs.IsPresent) {
SendAs
}
if ($SendOnBehalf.IsPresent) {
SendOnBehalfTo
}
if((($FullAccess.IsPresent) -eq $false) -and (($SendAs.IsPresent) -eq $false) -and (($SendOnBehalf.IsPresent) -eq $false)){
FullAccess
SendAs
SendOnBehalfTo
}
}
elseif (($CSV -ne "")) {
Import-Csv $CSV -ErrorAction Stop | ForEach-Object {
$UPN = $_.UPN
$UserInfo = $global:Mailbox | Where-Object { $_.UserPrincipalName -eq "$UPN" } | Select-Object Identity
$Identity = $UserInfo.Identity
Write-Progress "Processing for the Mailbox: $Identity"
if ($FullAccess.IsPresent) {
FullAccess
}
if ($SendAs.IsPresent) {
SendAs
}
if ($SendOnBehalf.IsPresent) {
SendOnBehalfTo
}
if((($FullAccess.IsPresent) -eq $false) -and (($SendAs.IsPresent) -eq $false) -and (($SendOnBehalf.IsPresent) -eq $false)){
FullAccess
SendAs
SendOnBehalfTo
}
}
}
else {
$MBCount = 0
$global:Mailbox | ForEach-Object {
$MBCount = $MBCount + 1
$UPN = $_.UserPrincipalName
$Identity = $_.Identity
Write-Progress -Activity "Processing for : $Identity" -Status "Processing mailbox Count: $MBCount"
if ($FullAccess.IsPresent) {
FullAccess
}
if ($SendAs.IsPresent) {
SendAs
}
if ($SendOnBehalf.IsPresent) {
SendOnBehalfTo
}
if((($FullAccess.IsPresent) -eq $false) -and (($SendAs.IsPresent) -eq $false) -and (($SendOnBehalf.IsPresent) -eq $false)){
FullAccess
SendAs
SendOnBehalfTo
}
}
}
if ((Test-Path -Path $global:ExportCSVFileName) -eq "True") {
Write-Host `n "The Output file availble in: " -NoNewline -ForegroundColor Yellow; Write-Host "`"$global:ExportCSVFileName`""`n
$prompt = New-Object -ComObject wscript.shell
$userInput = $prompt.popup("Do you want to open output files?", 0, "Open Output File", 4)
if ($userInput -eq 6) {
Invoke-Item "$global:ExportCSVFileName"
}
}
Disconnect-ExchangeOnline -Confirm:$false -InformationAction Ignore -ErrorAction SilentlyContinue
Write-Host "Disconnected active ExchangeOnline session"
Write-Host `n~~ Script prepared by AdminDroid Community ~~`n -ForegroundColor Green
Write-Host "~~ Check out " -NoNewline -ForegroundColor Green; Write-Host "admindroid.com" -ForegroundColor Yellow -NoNewline; Write-Host " to get access to 1800+ Microsoft 365 reports. ~~" -ForegroundColor Green `n`n